Cloud Forensics

What it is and why it matters

When a company moves its servers, mailboxes and files to a cloud provider, the evidence moves with them. There is no drive to pull and image. The disk under a virtual machine belongs to the provider and sits in a data centre the examiner will never visit, shared with other customers. What the examiner can reach instead is a set of interfaces: audit logs that record every API call, snapshots of virtual disks, exports of mailboxes and storage buckets and the provider's own records released under legal process.

The shape of the investigation depends on the service model. With infrastructure as a service the customer still controls the operating system, so a virtual machine can be snapshotted and examined much like a physical one. With platform and software services the customer sees only the application and its logs, and the question becomes which logs the provider keeps, for how long and in what form. A cloud examiner spends a great deal of time reading provider documentation for exactly that reason.

Cloud investigations also raise the question of who may collect what. An organisation can examine its own tenant under its own authority and policies. Data in a third party's account, or a personal account that happens to be linked to a work device, needs the account holder's consent or a lawful order served on the provider. The same principle that stops an examiner booting someone else's laptop stops them logging into someone else's cloud.

Common investigative uses

Working out how an attacker gained access to a cloud account and what they created, read or changed once inside
Establishing the scope of a data breach, including which objects were downloaded and whether a storage bucket was exposed to the internet
Investigating fraud, misuse of privileges or sabotage by an administrator with cloud access
Tracing a departing employee's downloads from company cloud storage in the weeks before leaving
Supporting breach notification duties under the Digital Personal Data Protection Act, 2023 and the CERT-In Directions with a precise account of what happened
Recovering evidence from a virtual machine that has been deleted, through snapshots and backups the attacker did not reach
Checking a provider's own account of an outage or security event against the customer-side logs

Types of digital evidence

Control Plane Audit Logs
AWS CloudTrail, Azure Activity Log, Microsoft Entra audit logs and Google Cloud Audit Logs record who called which API, from which address, when and with what result. They are the backbone of every cloud timeline.
Identity and Sign-In Records
Sign-in logs with user, application, IP address, device, location estimate, multi-factor outcome and conditional access decision, which show how an account was used and from where.
Virtual Machine Disks and Snapshots
Point-in-time copies of block storage volumes that can be exported or attached to an analysis machine and examined with ordinary disk forensic tools.
Object Storage Access Logs
Records of reads, writes, deletions and permission changes on buckets and containers, which show which objects were downloaded and whether a bucket was made public.
Network Flow Logs
VPC flow logs and virtual network flow logs that summarise traffic between cloud workloads and the internet, the cloud equivalent of NetFlow.
Application and Platform Logs
Logs from managed databases, serverless functions, load balancers and container platforms, kept in the provider's logging service with their own retention.
Configuration and Resource State
The current and historical configuration of resources, security groups, roles and policies, which shows what was changed to open a door and when.
Provider Records Under Legal Process
Subscriber details, payment records, access logs and content that only the provider holds and releases to law enforcement on a valid order.

Devices and data sources

AWS accounts and organisations with CloudTrail, S3, EBS and VPC flow logs
Microsoft Azure subscriptions and Microsoft Entra ID tenants
Google Cloud projects and Google Workspace domains
Virtual machine images and snapshots exported from any of the above
Cloud storage services such as OneDrive, Google Drive and Dropbox, through their audit logs and local sync clients
Backup services and disaster recovery copies that preserve earlier states
Container registries and Kubernetes clusters with their own audit logs
Local traces on endpoints such as sync client databases, cached tokens and browser history that show which cloud accounts were used

How an examination runs

The order matters. Each step protects the one after it.

01
Establish Ownership and Authority
Identify whose tenant or account holds the data and obtain written authorisation from that owner, or a lawful order if the owner is not the client. Record the scope of accounts, regions and services.
02
Preserve First
Turn on or extend logging where it is off, place legal holds on mailboxes and drives, snapshot affected virtual machines and copy existing logs out of the provider's retention window before anything expires. Send preservation requests to any third-party provider at once.
03
Map the Environment
List accounts, subscriptions, projects, regions, identities and roles. Cloud estates sprawl, and the resource that matters is often in a region nobody remembers.
04
Collect Logs With Their Metadata
Export audit, sign-in and access logs in their native format, with the provider's own timestamps and event identifiers. Hash the exports. Note any gaps where retention had already removed data.
05
Acquire Disks and Memory Where Possible
For infrastructure workloads, snapshot the volume, export it to a forensic image and verify its hash. Memory can only be captured through an agent on a running instance, so decide early whether that is worth the change it causes.
06
Build the Timeline
Normalise to UTC, join events by request identifiers and user identities and separate human actions from automated and service-principal activity.
07
Report With the Limits Stated
Explain which logs existed, which had expired, what the provider could not supply and where a finding rests on the provider's records rather than on data the examiner could independently verify.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Shared Responsibility: The division of duties between provider and customer. The provider secures the hardware and the platform. The customer secures what they build on it, including their logging.
Tenant: A customer's isolated slice of a shared cloud platform, identified by an account, subscription, project or domain.
Control Plane and Data Plane: The control plane handles management actions such as creating a server or changing a policy. The data plane handles the reads and writes of the data itself. They are logged separately and often with different retention.
Snapshot: A point-in-time copy of a block storage volume. Snapshots are the cloud route to a disk image, and they can be made without stopping the machine.
Service Principal: A non-human identity used by applications and automation. Many cloud intrusions run through one, so activity by service principals needs the same scrutiny as user activity.
Legal Hold: A setting in a service such as Microsoft 365 or Google Workspace that stops items being deleted or altered while a matter is open, including by the user.
Preservation Request: A request to a provider to retain specified records for a period, pending legal process. It does not release the data. It keeps it from being deleted.
Data Residency: The physical region where data is stored, which decides whose law applies and which authority can order its release.
Mutual Legal Assistance: The treaty route through which an Indian investigator can seek records held by a provider in another country. It works, but slowly.

Challenges and limits

What makes it hard

Audit log retention is short unless someone configured longer storage, so logs for the period in question may already be gone
Logging that was never turned on cannot be recovered. Data access logs in particular are often off by default because of cost
The examiner cannot verify the provider's logs against the hardware. They are trusted records, not independently acquired evidence, and the report should say so
Multi-tenancy means a physical disk cannot be seized without affecting other customers, and providers do not permit it
Data may sit in a region outside India, so a request for provider records goes through legal assistance channels with long delays
Cloud estates change by the minute through automation, and the resource under examination may be re-created or destroyed before it is preserved
Logs record identities and keys, not people. Shared credentials, stolen tokens and automated pipelines make attribution harder than the username suggests

Keeping the evidence intact

Export logs in the provider's native format with their original event identifiers and timestamps, and hash the export at once
Record the account, role and method used for every collection, so that the examiner's own actions can be separated from those under investigation
Use a dedicated collection identity with read-only permissions, created and documented for the case, rather than an administrator's everyday account
Snapshot before touching a workload, and keep the snapshot identifier, creation time and hash of any exported image in the case record
Keep provider correspondence, preservation requests and legal orders with the evidence, since they explain why some data exists and some does not

Standards and legal considerations

NIST IR 8006
NIST Cloud Computing Forensic Science Challenges. A catalogue of the technical, legal and organisational problems that make cloud forensics different, and a useful checklist of what to expect.
ISO/IEC 27037:2012
The principles of identification, collection, acquisition and preservation apply to cloud exports and snapshots as much as to seized drives.
Read the guide
CERT-In Directions 2022
Covered organisations, including cloud service providers and virtual server providers, must keep logs for 180 days, maintain certain customer records and report incidents within six hours.
Read the guide
Digital Personal Data Protection Act, 2023
Sets duties on organisations that process personal data in India, including breach notification. Cloud investigations almost always involve personal data and must respect it.
Read the guide
GDPR
Where the organisation processes the data of people in the European Union, the General Data Protection Regulation shapes what may be collected during an investigation and how it is handled.
Read the guide

In practice

A Public Bucket
A company is told that its customer files are visible on the internet. The examiner reads the object storage access logs and the configuration history, finds the moment the bucket policy was changed to allow public reads, the identity that made the change and every anonymous download since. The report lists the objects downloaded, their sizes and the requesting addresses, and notes that the logs began only when the company enabled them six months earlier.
A Stolen Session Token
A finance manager's cloud account sends payment instructions nobody recognises. Sign-in logs show the account used from two countries within an hour with no fresh password entry. The audit log shows a new mailbox rule and an application consent granted in the same session. The examiner concludes the session token was stolen from the manager's browser and points to the endpoint for the infection.
A Deleted Virtual Machine
An attacker deletes a web server after copying its database. The server is gone, but a nightly snapshot of its volume exists. The examiner exports the latest snapshot to a forensic image, hashes it and examines the web server logs on it, which show the queries that extracted the data and the address they came from.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.IntermediateCloud / Network

NetworkNetwork & Cloud ForensicsVirtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.AdvancedCloud / Network

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Standards for this area

Careers that use it

Questions people ask

Can an examiner image a cloud server the way they image a laptop?

For infrastructure services, almost. The volume is snapshotted and exported to an image file, which is then hashed and examined with normal tools. For platform and software services there is no disk to reach, and the evidence is whatever the service logs and exports.

Who can authorise access to a cloud account?

The owner of the tenant or account, through their own policies and the roles they grant. For an account owned by someone else, the account holder's consent or a lawful order served on the provider is needed. Credentials found on a device are not authority to use them.

What if the logs were never enabled?

Then that period has no record, and nothing can bring it back. The examiner documents what was on and what was off, works from whatever other sources exist and recommends the logging changes that would help next time.

Are cloud provider logs accepted as evidence?

They are business records generated by the provider, and courts generally receive them with proper certification and chain of custody. Under the Bharatiya Sakshya Adhiniyam, 2023 an electronic record needs the certificate the Act requires. The examiner keeps the export, its hash and the method of collection to support that.